Layered Threat Modeling

Layered threat modeling breaks a system into distinct architectural layers so teams can analyse risks where they actually arise. For AI systems, that means separating model behaviour, memory, tools, deployment, observability, and ecosystem exposure instead of treating the whole stack as one threat surface.

Expanded Definition

Layered threat modeling is a structured way to analyse risk by separating a system into security-relevant layers and examining how threats differ at each layer. For AI and agentic systems, that usually means distinguishing the model, prompts, memory, tools, orchestration, identity, deployment environment, telemetry, and upstream or downstream ecosystem dependencies rather than treating the stack as one combined risk surface.

This approach is useful because the same failure can have different causes and controls depending on where it appears. A prompt injection issue, for example, is not the same as a weak tool permission, an exposed secret, or a logging gap. The discipline is closely aligned with modern AI risk methods such as MITRE ATLAS adversarial AI threat matrix and the CSA MAESTRO agentic AI threat modeling framework, both of which reinforce the need to reason about attack paths by layer.

Definitions vary across vendors on how many layers to use, but the underlying goal is stable: map threats to the place where they are introduced, propagated, or enforced. The most common misapplication is flattening all AI risk into a single “model security” discussion, which occurs when teams ignore memory, tools, identity, and deployment controls as separate failure points.

Examples and Use Cases

Implementing layered threat modeling rigorously often introduces more analysis overhead, requiring organisations to balance clearer risk visibility against longer workshop cycles and more control mapping.

• An AI assistant is reviewed separately for prompt injection risk, tool misuse, and secret exposure, rather than assessed as one generic “LLM risk” category.
• A deployment review distinguishes cloud configuration weaknesses from model behaviour issues, helping teams decide whether the fix belongs in infrastructure hardening or application logic.
• An agentic workflow is mapped across identity, action approval, and memory persistence so that overly broad permissions are not mistaken for a pure model safety issue.
• Security teams use CISA cyber threat advisories alongside internal attack paths to separate current external threats from design-time assumptions.
• Analysts compare ecosystem exposures, such as third-party APIs or retrieval sources, against model-level safeguards to see where malicious input can enter and where it can spread.

These use cases matter because the same incident can present differently at each layer. A compromised retrieval source may corrupt outputs, while a weak tool policy may turn those outputs into harmful actions, and an observability gap may hide both. Layered analysis gives teams a way to assign ownership and choose controls that fit the real failure mode.

Why It Matters for Security Teams

For security teams, layered threat modeling prevents false confidence. It stops organisations from assuming that a single control, such as prompt filtering or model fine-tuning, is enough to manage the whole AI system. That matters because modern attacks often chain weaknesses across layers: an adversary may influence inputs, exploit tool access, abuse identity trust, and then evade detection through poor telemetry. The Anthropic — first AI-orchestrated cyber espionage campaign report is a useful reminder that real-world abuse often combines model interaction with broader operational compromise.

For NHIMG, the identity connection is central: in agentic systems, privileges, secrets, service accounts, and delegated actions can become the actual attack surface. Layered threat modeling helps teams separate Non-Human Identity risk from model risk and from infrastructure risk, which is essential when deciding whether the fix is IAM, PAM, segmentation, or secure orchestration.

Organisations typically encounter the full value of layered threat modeling only after a cross-layer incident shows that the weakest control was not the one they had been monitoring, at which point the method becomes operationally unavoidable to investigate and contain the failure.

Related resources from NHI Mgmt Group

• How should security teams apply threat modeling to AI systems?
• What do teams get wrong about AI threat modeling?
• How should security teams use AI copilots for threat modeling without losing control?
• Why does AI-assisted threat modeling depend so heavily on input quality?